{
  "id": 16592261,
  "title": "eMudhra Apologises After Weak Keys Expose Eight Certificate Authorities, Exits Global SSL/TLS Business",
  "url": "https://urgent.news/2026/10/26/emudhra-apologises-after-weak-keys-expose-eight-certificate",
  "topic": "world",
  "section": "World",
  "published": "2026-10-26T10:59:03.000Z",
  "source": {
    "name": "Free Press Journal",
    "slug": "free-press-journal",
    "url": "https://www.freepressjournal.in/tech/emudhra-apologises-after-weak-keys-expose-eight-certificate-authorities-exits-global-ssltls-business"
  },
  "original_language": "en",
  "account": "Indian digital trust company eMudhra has issued an apology after eight of its intermediate certificate authorities (CAs) were discovered to utilize easily guessable private keys. The company has revoked the affected certificates, asserting that there is no evidence of misuse, and has decided to exit the global SSL/TLS business. Security researcher identified the issue on October 17, noting that the private keys for six of the eight affected CAs, responsible for website (TLS) security, and two for code signing, could be recovered within a second. eMudhra acknowledged that the keys were not strong P-384 keys as intended and were generated due to a script error during a key generation ceremony. This flaw allowed for near-instant recovery of the weak keys from the public keys, which were created on April 30, 2025. No evidence of misuse has been found, but the long exposure period raises concerns about potential abuse. Browsers such as Google, Mozilla, and Apple, along with Mozilla Firefox, blocked the affected certificates on October 17, with Chrome set to follow on October 27. As a result, customers holding certificates under the affected root must reissue them. eMudhra voluntarily withdrew from the global SSL/TLS certificate business on October 22, offering customers certificates from Sectigo in the interim. The company urges organizations to update browsers, refresh trusted-certificate lists, and replace certificates in the affected chain, advising against bypassing certificate warnings. The researcher raised concerns about a potential revocation list issue for eMudhra's G1 root, but it remains unclear whether further distrust will follow or how many certificates will need reissuing.",
  "summary": "Indian digital trust company eMudhra has apologised publicly after eight of its intermediate certificate authorities (CAs) were found to use easily guessable private keys. It has revoked the affected certificates, says it has no evidence of misuse, and has decided to leave the global SSL/TLS business. What happened A security researcher reported on October 17 that the private keys for eight…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}